Disintegration Imaging 1.6.2 allows attackers to cause a panic (because of an integer index out of range during a Grayscale call) via a crafted TIFF file to…
Full advisory text at GitHub advisory or NVD.
go package report
Is github.com/disintegration/imaging safe?
github.com/disintegration/imaging (go) has 1 known vulnerability, the worst rated LOW. No malicious-package signal is recorded.
// reach
0 direct dependencies
none carry a known advisory
55 packages depend on it
an advisory here reaches each of them
Create a free accountfor every dependency path, dependent and what to upgrade
// ai model usage
Tracked for PyPI packages. HuggingFace models declare Python dependencies, so go packages are not covered.
cvss
2.5
low
severity band, no base score published
epss
0.39%
low
chance of exploitation in 30 days, 33rd percentile of all CVEs
xyz score
1.3
low
CyberXYZ composite out of 10
fig. 01 — GHSA-q7pp-wcgr-pffx, the advisory selected below
// 1 advisories
Is github.com/disintegration/imaging safe to install?
CyberXYZ does not call a package safe in absolute terms. It records 1 known vulnerability for github.com/disintegration/imaging (go), the worst rated LOW, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does github.com/disintegration/imaging have known vulnerabilities?
Yes. CyberXYZ records 1 known vulnerability for github.com/disintegration/imaging (go), the worst rated LOW. They are GHSA-q7pp-wcgr-pffx.
How do I check github.com/disintegration/imaging before installing?
Search github.com/disintegration/imaging in CyberXYZ Check at https://cyberxyz.io/check?q=github.com%2Fdisintegration%2Fimaging. The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 08:41 UTC. The most recent advisory here was published 2023-09-05. Updated continuously from NVD, GHSA, OSV and CNA feeds.